Yep. But spam detection and flagging is a hard problem. Google tries to detect and flag malicious creatives and stop them from serving, but it's not perfect. (I've touched that subsystem in a past life).
Consider the likely interaction: (a) Spammer tries to figure out a twist on the ad that makes it through the inappropriate ad filters. They keep at this until they get an image or wording that works.
(b) Slightly different system goes and tries to find malicious sites. It detects a site where the spammer managed (a) successfully, because it uses some different methods of identifying the bad stuff.
I don't find this kind of result surprising at all, particularly given how big Google is. If the site safety team is different from the don't-show-evil-ads team, it's almost an inevitable result, at least, in some point in the evolution of the system(s) and processes involved. It does point out some improvements that are needed.
I still don't get it. It's like the city randomly testing drinking fountains for lead, then issuing penalties to businesses, when the city municipal supply is the issue. Sure, shut down the water, but don't penalize victims.
That same scraper that's flagging the site can see the adsense block, see that image url for the offending image is "googlesyndication.com/some/image", etc. As far as I can tell, enough info to map directly back to the entity paying for the ad to show.
